IT37064: USER WITH "VIEW" PERMISSION CANNOT COMPLETE QUERY VIA REST API TO REQUEST INFORMATION FROM VSNAP

APAR status

• Closed as program error.

Error description

• If an user has "VIEW" permission in IBM Spectrum Protect Plus,
  the query using REST API fails with following exception:
  
    https://%address%/api/storage/2101/management/pool
  ERROR:HttpClientResult [rc=8, statusInfo=Forbidden,
  Rest Endpoint:
    https://%address%/api/storage/2101/management/pool
  
  If the user has "VIEW" permission and then changed the
  permission to "EDIT" the result is a successful query.
  
  IBM Spectrum Protect Versions Affected:
  IBM Spectrum Protect Plus 10.1.7 and later
  
  Additional Keywords: SPP, SPPLUS, TS004937717, IN, free disk
                       space, threshold
  

Local fix

• Give edit permission to the user.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Protect Plus levels 10.1.7 and 10.1.8           *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * see ERROR Description                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply the fixing level when available. This problem is       *
  * currently projected to be fixed in IBM Spectrum Protect Plus *
  * level 10.1.8 patch1 and 10.1.9.                              *
  * Note that this is subject to change at the discretion of     *
  * IBM.                                                         *
  ****************************************************************
  

Problem conclusion

• When querying vSnap information using the REST API, an incorrect
  check for 'Edit' permissions was performed which caused the
  problem. A code fix has been implemented to check for 'View'
  permissions instead.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SP PLUS

• Fixed component ID

  5737SPLUS

Applicable component levels